Have you set next core parameter?

* https://www.kamailio.org/wiki/cookbooks/devel/core#tcp_accept_hep3

Is the event route used, like in:

* https://github.com/kamailio/kamailio/issues/1294#issuecomment-342075959

I checked the binary of the received packet, on UDP the data is extracted from the packet itself while on TCP it is taken from the connection info (s.ip, s.port, d.ip, d.port) Maybe with UDP, it uses hep module while with TCP, it uses sipcapture module?

I am using the same server, seeing different results for traffic that arrives over UDP compared to TCP.

``` ####### Global Parameters #########

fork=yes children=8 tcp_children=8

/* uncomment the next line to disable TCP (default on) */ # disable_tcp=yes

/* IP and port for HEP capturing) */ listen=tcp:HOMER_LISTEN_IF:HOMER_LISTEN_PORT listen=udp:HOMER_LISTEN_IF:HOMER_LISTEN_PORT

tcp_accept_hep3=1 tcp_accept_no_cl=yes ...

####### Routing Logic ######## modparam("sipcapture", "db_url", "mysql://root:****@*****/****") modparam("sipcapture", "capture_on", 1) modparam("sipcapture", "hep_capture_on", 1) modparam("sipcapture", "insert_retries", 5) modparam("sipcapture", "insert_retry_timeout", 10) #new event sipcapture socket modparam("sipcapture", "nonsip_hook", 1) #modparam("sipcapture", "capture_node", "homer01") ...

route[STORE] {

$var(a) = $var(table) + "_" + $var(utc); sip_capture("$var(a)"); } ...

event_route[sipcapture:request] {

#Is it SIP ? if($hep(0x00b) == 1) { #Do parsing internal return 1; } else { #If report lets proceed here with payload xlog("HEP CHUNK PAYLOAD $hep(0x00f) request from $si:$sp\n"); return 0; } } ```

The code of the module needs to be analyzed for this case. Maybe @adubovikov or @giavac can provide a quick hint/fix of what is going wrong there.

Sure: 48 45 50 33 01 cf 00 00 00 01 00 07 02 00 00 00 02 00 07 11 00 00 00 07 00 08 13 c4 00 00 00 08 00 08 13 c6 00 00 00 09 00 0a 5a 27 fd 7d 00 00 00 0a 00 0a 00 0f 22 81 00 00 00 0b 00 07 01 00 00 00 0c 00 0a 00 00 07 d0 00 00 00 03 00 0a 0a cb 86 80 00 00 00 04 00 0a 0a cb 86 bb 00 00 00 0e 00 0b 6d 79 68 65 70 00 00 00 0f 01 67 4f 50 54 49 4f 4e 53 20 73 69 70 3a 31 30 2e 32 30 33 2e 31 33 34 2e 31 38 37 3a 35 30 36 32 20 53 49 50 2f 32 2e 30 0d 0a 56 69 61 3a 20 53 49 50 2f 32 2e 30 2f 55 44 50 20 31 30 2e 32 30 33 2e 31 33 34 2e 31 32 38 3a 35 30 36 30 3b 62 72 61 6e 63 68 3d 7a 39 68 47 34 62 4b 33 33 35 39 2e 38 35 64 63 31 38 63 31 2e 30 0d 0a 54 6f 3a 20 73 69 70 3a 31 30 2e 32 30 33 2e 31 33 34 2e 31 38 37 3a 35 30 36 32 0d 0a 46 72 6f 6d 3a 20 3c 73 69 70 3a 70 72 6f 62 65 72 40 6c 6f 63 61 6c 68 6f 73 74 3e 3b 74 61 67 3d 33 66 62 32 65 66 31 62 32 38 35 32 65 64 65 32 33 61 38 35 36 33 35 65 62 36 30 64 33 61 66 35 2d 62 33 38 30 0d 0a 43 53 65 71 3a 20 31 30 20 4f 50 54 49 4f 4e 53 0d 0a 43 61 6c 6c 2d 49 44 3a 20 32 33 66 61 64 62 61 65 33 38 66 32 32 35 39 30 2d 32 38 32 36 30 40 30 2e 30 2e 30 2e 30 0d 0a 4d 61 78 2d 46 6f 72 77 61 72 64 73 3a 20 37 30 0d 0a 43 6f 6e 74 65 6e 74 2d 4c 65 6e 67 74 68 3a 20 30 0d 0a 55 73 65 72 2d 41 67 65 6e 74 3a 20 4f 70 65 6e 53 49 50 53 20 28 32 2e 32 2e 35 20 28 78 38 36 5f 36 34 2f 6c 69 6e 75 78 29 29 0d 0a 0d 0a

I already analyzed it and made sure that the data here is correct

At the moment I've only been able to reproduce the issue, but I have no solution yet. If you spot the issue or find a patch feel free to say and I'll test/review. Thanks.

Closed #1353.